SCS-C02 Threat Detection and Incident Response Practice Test 11 — 15 Questions

Question 1

A company uses Amazon S3 to store sensitive data. The security team wants to detect and alert on public read access to S3 buckets. Which combination of AWS services is MOST appropriate?

Accepted Answer

Amazon Macie with automated discovery jobs and Amazon CloudWatch Events to send alerts.. Amazon Macie is purpose-built for discovering and protecting sensitive data in S3, and its automated discovery jobs can detect public read access to buckets. By integrating with Amazon CloudWatch Events, Macie can trigger alerts in real-time when such access is identified, making it the most appropriate choice for this detection and alerting requirement.

Answer

AWS CloudTrail and Amazon CloudWatch Logs with metric filters for `PutBucketPolicy` events.

Answer

Amazon GuardDuty and AWS Lambda.

Answer

AWS Config with managed rules like `s3-bucket-public-read-prohibited` and Amazon SNS.

Question 2

During incident response, a security engineer needs to preserve the state of a running EC2 instance for forensic analysis without losing volatile data. The instance is in an Auto Scaling group. Which action should the engineer take FIRST?

Accepted Answer

Suspend the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group.. Option D is correct because suspending the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group prevents the group from detecting the instance as unhealthy and terminating it while the engineer preserves volatile data. This is the first step to ensure the instance remains running and accessible for forensic collection (e.g., memory dump) before any other actions that could alter its state.

Answer

Detach the instance from the Auto Scaling group.

Answer

Stop the instance to preserve its EBS volumes.

Answer

Take an AMI of the instance immediately.

Question 3

A security engineer is investigating a potential data exfiltration from an AWS account. Which TWO CloudTrail events would be MOST indicative of data exfiltration via S3?

Accepted Answer

`CopyObject` API calls from a production bucket to a bucket in another AWS account.. Option B is correct because `CopyObject` API calls from a production bucket to a bucket in another AWS account indicate data being replicated or moved across account boundaries, which is a strong signal of potential data exfiltration. This action bypasses typical network controls and can transfer large volumes of data without requiring a download, making it a common exfiltration technique.

Answer

`PutObject` API calls from a known internal IP.

Answer

`ListObjects` API calls from an EC2 instance in the same VPC.

Answer

`DeleteObject` API calls from the root user.

Question 4

A security team is implementing automated response to AWS GuardDuty findings. Which THREE actions should be taken to ensure proper incident response?

Accepted Answer

Create an AWS Lambda function that automatically modifies the security group of the affected instance to block all traffic.. Option A is correct because isolating the affected instance by modifying its security group to block all traffic is a common containment strategy that stops malicious network activity without destroying evidence. This approach allows the security team to perform forensic analysis and remediation while preventing further compromise, aligning with AWS incident response best practices.

Answer

Terminate the affected instance immediately to neutralize the threat.

Answer

Disable AWS CloudTrail to prevent further logging of malicious activity.

Question 5

Which TWO AWS services can be used to detect anomalous API calls in an AWS account?

Accepted Answer

AWS CloudTrail with Amazon CloudWatch Logs metric filters.. AWS CloudTrail with Amazon CloudWatch Logs metric filters is correct because CloudTrail records all API calls, and you can create metric filters on CloudWatch Logs to match patterns indicative of anomalous activity (e.g., unauthorized API calls, root user activity). When the filter triggers a threshold, it can send an alarm via Amazon SNS, enabling detection of anomalous API calls in near real-time.

Answer

AWS Shield Advanced.

Answer

AWS Config with managed rules.

Answer

AWS WAF.

Question 6

A security engineer finds this IAM policy attached to a user. The user is able to create CloudTrail trails but cannot start logging. What is the MOST likely reason?

Accepted Answer

The user lacks `iam:PassRole` permission for the CloudTrail service role.. The user can create CloudTrail trails but cannot start logging because starting logging requires the `iam:PassRole` permission to pass the CloudTrail service role to the CloudTrail service. Without this permission, CloudTrail cannot assume the role needed to write logs to the S3 bucket and deliver them to CloudWatch Logs, even though the user has `cloudtrail:CreateTrail` and `cloudtrail:StartLogging` actions in the policy.

Answer

The `StartLogging` action is not listed in the policy.

Answer

The policy does not specify the `cloudtrail:StartLogging` action.

Answer

The user does not have permission to create CloudTrail trails.

Question 7

A security engineer is analyzing VPC Flow Logs and sees the entry above. The source IP 203.0.113.5 is flagged as suspicious. What additional information would help determine if this is malicious?

Accepted Answer

CloudTrail logs for any `ConsoleLogin` or `AssumeRole` events from 203.0.113.5.. Option B is correct because VPC Flow Logs capture network traffic metadata (IPs, ports, protocols) but not the identity or authentication context of the source. CloudTrail logs record API calls, including ConsoleLogin and AssumeRole events, which can reveal whether 203.0.113.5 is associated with an authenticated user or role. If no such events exist, the traffic is likely from an unauthenticated external source, strengthening the case for malicious activity.

Answer

The source port used by 203.0.113.5.

Answer

Network ACL changes associated with the destination subnet.

Answer

Amazon GuardDuty findings for the destination 10.0.1.5.

Question 8

A security engineer creates an Amazon CloudWatch Events rule with this event pattern to trigger an AWS Lambda function for automated response to GuardDuty findings. However, the Lambda function is not triggered for new findings. What is the MOST likely cause?

Accepted Answer

The event pattern does not match the actual structure of GuardDuty findings.. Option C is correct because the event pattern provided in the CloudWatch Events rule must exactly match the JSON structure of a GuardDuty finding as it is published to the default event bus. GuardDuty findings are delivered with a specific schema that includes a `detail` object containing `type`, `severity`, and other fields. If the event pattern uses incorrect field names, nesting, or missing required elements (e.g., `source` must be `aws.guardduty`), CloudWatch Events will not match the incoming events, and the Lambda function will not be triggered.

Answer

The finding type is not specified in the pattern.

Answer

CloudTrail is not enabled in the account.

Answer

The Lambda function does not have permission to be invoked by CloudWatch Events.

Question 9

A security engineer is investigating a potential data exfiltration from an S3 bucket. The engineer needs to identify which IAM role or user accessed the bucket and from which IP address. Which AWS service should the engineer use to obtain this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to S3, including the IAM role or user identity (via the `userIdentity` field) and the source IP address (via the `sourceIPAddress` field). For data exfiltration investigation, you need these specific details from management events or data events (e.g., `GetObject`, `PutObject`), which CloudTrail captures. Other services either lack identity-level detail or focus on network-level traffic without user attribution.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Question 10

A security engineer is designing an automated incident response workflow for an Amazon EC2 instance that is compromised. The workflow must isolate the instance by removing it from the security group that allows SSH access. The engineer wants to use AWS Systems Manager Automation to run a document. What is the most secure way to grant the automation the necessary permissions to modify the security group?

Accepted Answer

Create a Systems Manager Automation service role with a least-privilege policy that includes ec2:ModifySecurityGroupRules and use that role in the automation.. Option A is correct because Systems Manager Automation can assume a dedicated service role with a least-privilege IAM policy that includes the specific action `ec2:ModifySecurityGroupRules`. This follows the security best practice of granting only the permissions required for the automation to modify the security group, without exposing broader privileges or relying on user or instance credentials.

Answer

Create an AWS Lambda function with permissions to modify the security group and call it from the automation.

Answer

Use the IAM user's permissions that trigger the automation.

Answer

Attach an IAM policy to the EC2 instance's instance profile that allows ec2:ModifySecurityGroupRules.

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze VPC Flow Logs from all accounts. The team has set up a central logging account with an S3 bucket that has a bucket policy allowing cross-account writes. However, VPC Flow Logs from member accounts are not appearing. What is the most likely cause?

Accepted Answer

VPC Flow Logs cannot be published directly to an S3 bucket in a different account. The logs must be published to a bucket in the same account as the VPC, and then replicated to the central account.. Option A is correct because VPC Flow Logs can be published to Amazon S3 only if the log group and stream are in the same account as the VPC; cross-account publishing is not supported directly. Option B is wrong because CloudTrail is not involved in Flow Log collection. Option C is wrong because S3 bucket policies are not the issue as they allow cross-account writes. Option D is wrong because Flow Logs can be published to a central bucket via cross-account delivery with proper permissions, but the key point is that the bucket must be in the same account as the VPC or use S3 replication.

Answer

AWS CloudTrail is not enabled in the member accounts.

Answer

The VPC Flow Logs must be delivered to CloudWatch Logs first, then exported to S3.

Answer

The S3 bucket policy does not allow the s3:PutObject action for the member accounts.

Question 12

A security engineer is configuring Amazon GuardDuty in a multi-account environment using AWS Organizations. The engineer wants to designate a delegated administrator account to manage GuardDuty for all member accounts. Which AWS service must be used to enable GuardDuty for all accounts?

Accepted Answer

AWS Organizations. Option D is correct because AWS Organizations is the foundational service required to designate a delegated administrator for Amazon GuardDuty in a multi-account environment. GuardDuty integrates directly with Organizations to allow a management account to enable GuardDuty for all member accounts and delegate administration to a specified account, which then manages threat detection across the organization without needing additional services.

Answer

AWS CloudFormation StackSets

Answer

AWS Control Tower

Answer

AWS Config

Question 13

A security engineer notices suspicious API calls from an EC2 instance that has an IAM role attached. The engineer wants to quickly determine if the instance's credentials have been compromised and are being used from an external IP address. What is the most efficient way to detect this?

Accepted Answer

Enable Amazon GuardDuty and look for the finding type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration'.. Option B is correct because GuardDuty has a finding type 'UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration' that detects when EC2 instance credentials are used from an external IP. Option A is wrong because CloudTrail logs would show the calls but require manual analysis. Option C is wrong because VPC Flow Logs do not include IAM principal information. Option D is wrong because IAM Access Analyzer focuses on resource policies, not credential misuse.

Answer

Check VPC Flow Logs for traffic from the instance to unusual destinations.

Answer

Review AWS CloudTrail logs for the instance's IAM role and look for source IP addresses outside the VPC.

Answer

Use IAM Access Analyzer to review the trust policy of the instance's IAM role.

Question 14

A company has a security requirement to automatically isolate an Amazon EC2 instance that is generating high network traffic to a known malicious IP address. The company uses Amazon GuardDuty and AWS Lambda. Which combination of services and configurations should be used to achieve the isolation?

Accepted Answer

Use Amazon GuardDuty to send findings to Amazon CloudWatch Events, which triggers an AWS Lambda function that modifies the security group to remove the instance.. Option C is correct because Amazon GuardDuty generates findings for threats like communication with known malicious IPs, and these findings can be sent to Amazon CloudWatch Events (now Amazon EventBridge). CloudWatch Events can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to remove its inbound/outbound rules, effectively isolating the instance. This automated workflow meets the security requirement without manual intervention.

Answer

Use VPC Flow Logs to send logs to CloudWatch Logs, then create a metric filter that triggers a Lambda function.

Answer

Use Amazon GuardDuty to send findings to AWS Systems Manager Automation to run a document that isolates the instance.

Answer

Use AWS Config rules to detect the traffic and invoke a Lambda function to change the security group.

Question 15

A security engineer is investigating a potential security incident involving an Amazon RDS database. The engineer needs to determine if someone attempted to access the database with incorrect credentials. Which AWS service should the engineer use to view authentication failures?

Accepted Answer

Amazon RDS database logs (error logs). Option C is correct because RDS database logs (such as error logs) contain authentication failure entries. Option A is wrong because CloudTrail logs API calls to RDS, not database-level authentication. Option B is wrong because VPC Flow Logs show network traffic but not authentication attempts. Option D is wrong because CloudWatch Logs can store RDS logs but the source is the database logs.

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Answer

AWS CloudTrail